build(postgres): refresh Rust 1.98 digest contract

[seonghobae]

Rust 1.98 immutable build-input contract — Draft child of #233

This successor preserves Dependabot #326's production delta without closing or discarding it. Protected main is exact bdff1273d3885dedc5187632e1c8838b470c9b6d; no direct protected-main write, force push, destructive rebase, or predecessor-evidence transfer was used.

TDD lineage

• RED 38706b509eccabfa5dfd36af7e46916d5d05c2da: move the PostgreSQL image build to Rust 1.98 while the immutable dependency contract still requires the old digest; test_container_build_inputs_use_reviewed_immutable_digests rejects the mismatch.
• GREEN 927a1b8eb4b7013b52852f5ce256daea271b14fb: bind rust:1.98-slim-bookworm to reviewed digest sha256:1469a27c125cb5a3aebfa4f4e4665d935b02fb72cc093b2c974b3d740e43f157 in the repository-owned contract.
• 2edc2d3701f6695e3f656dae0e028e77d732d5d7: non-destructively reconciled protected fix(ci): revert docs-only paths-ignore, unsafe for this repo's doc-content contract tests #332, preserving its behavior-bearing CI correction.

Coverage RCA and dependency-root repair

Exact-head CI 33721095260 on 2edc2d3701f6695e3f656dae0e028e77d732d5d7 checked out the contributor head successfully. Compile, lint, public-docstring coverage, Python unit lanes, and PostgreSQL/container runtime smokes passed; the Coverage, docstrings, lint, and package job failed specifically at Enforce line coverage. The Rust 1.98 PR changes only the Dockerfile plus the immutable-input regression; the repository-wide inherited recovery-evidence weakref coverage arcs are already owned by dependency-root #233 rather than this lane.

Current head b64227c0fd5a10bf7ba0ca0b53a72f0180173ebe therefore non-destructively composes exact #233 head 32469711f9a26a26ebcf4a7efcf20938bfdc94db as a merge parent and carries its one test blob without copying that test as independent authority. The PR base is now #233's branch. Fresh compare from exact #233 to this head is ahead / zero behind and the relative diff remains exactly:

• docker/postgres/Dockerfile — Rust 1.98 immutable tag+digest;
• tests/test_dependency_refresh_contract.py — matching reviewed immutable-input contract.

No #233 production/test delta appears in this PR-relative diff. This is the causal stack repair for the inherited coverage failure, not a coverage-gate bypass.

Current validation / integration boundary

All workflow/review evidence on 2edc2d370... or earlier heads is historical after this restack. Reacquire exact-current-head CI/security/SAST/Scorecard/OSV/release/review/thread evidence for b64227c0fd5a10bf7ba0ca0b53a72f0180173ebe from scratch. Keep this PR Draft while #233 is unintegrated and while any current required gate is non-terminal.

After #233 reaches protected main, reconcile/retarget this child non-destructively onto the then-current protected base, prove the unique two-file delta again, and reacquire every exact-final-head/current-base quality, security, coverage, package, SBOM/provenance, release, review, and thread gate required by live governance.

Do not self-approve, routinely bypass protection, weaken gates, transfer stale/predecessor evidence, or close Dependabot #326 until complete successor inheritance is reverified against the final integrated result.

Summary by CodeRabbit

• 개선 사항
  • PostgreSQL 컨테이너 빌드에 사용되는 Rust 도구 모음이 최신 버전으로 업데이트되었습니다.
  • 컨테이너 이미지 무결성 검증을 위해 고정된 이미지 식별자를 갱신했습니다.
  • PostgreSQL 백업 및 스키마 증거 추적이 오래된 참조가 정리된 후에도 교체된 기록을 안정적으로 유지하도록 검증을 강화했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 71b09788-34ed-4681-aed4-32a8fda7ab11

📥 Commits

Reviewing files that changed from the base of the PR and between 7b7d5fb and b64227c.

📒 Files selected for processing (1)

• tests/test_postgres_recovery_evidence_registry.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

PostgreSQL Dockerfile의 Rust toolchain 이미지를 1.98로 갱신했습니다. 새 immutable digest 계약 테스트를 반영했습니다. 백업 및 스키마 증거 레지스트리의 stale weakref 콜백 동작을 검증하는 회귀 테스트를 추가했습니다.

Changes

의존성 갱신

Layer / File(s)	Summary
Rust 이미지 및 digest 갱신 docker/postgres/Dockerfile, tests/test_dependency_refresh_contract.py	Dockerfile이 Rust 1.98 이미지와 새 immutable digest를 사용합니다. 계약 테스트가 새 이미지와 digest를 검증합니다. USER postgres 지시문은 동일한 내용으로 다시 기록되었습니다. Ruff 버전 0.16.1 검증은 유지됩니다.

증거 레지스트리 회귀 검증

Layer / File(s)	Summary
stale 콜백 교체 항목 보존 테스트 tests/test_postgres_recovery_evidence_registry.py	백업 및 스키마 증거 객체를 교체한 뒤 원본 객체를 가비지 컬렉션합니다. stale weakref 콜백 이후에도 교체된 레지스트리 항목이 유지되는지 검증합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to b6422

This updates the pinned Rust build image and adds regression coverage for registry cleanup behavior. No current merge-blocking risk is identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 PostgreSQL의 Rust 1.98 이미지 다이제스트 및 검토된 불변성 계약 갱신이라는 주요 변경 사항을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/rust-1-98-digest-contract-b84f0c9

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 2 potential issues.